Scan this mobile 

code to learn more 

about the EPA OIG.

Cloud Oversight Resulted in 

Unsubstantiated and

Missed Opportunities for 

Savings, Unused and 

Undelivered Services, and 

Incomplete Policies 

Report No. 14-P-0332 August 15, 2014

U.S. ENVIRONMENTAL PROTECTION AGENCY

OFFICE OF INSPECTOR GENERAL
Report Contributors: Rudolph M. Brevard

Charles M. Dade

Albert E. Schmidt

Abbreviations

CFR Code of Federal Regulations

CIO Chief Information Officer

EPA U.S. Environmental Protection Agency

FAR Federal Acquisition Regulation

FY Fiscal Year

GSA General Services Administration 

IaaS Infrastructure-as-a-Service

IPv6 Internet Protocol version 6

IT Information Technology

NCC National Computer Center

NIST National Institute of Standards and Technology

OARM Office of Administration and Resources Management

OEI Office of Environmental Information

OIG Office of Inspector General

OMB Office of Management and Budget

TIC Trusted Internet Connection

Hotline Suggestions for Audits or Evaluations

To report fraud, waste or abuse, contact us 

through one of the following methods:

To make suggestions for audits or evaluations, 

contact us through one of the following methods:

email:

phone:

fax:

online:

write:

OIG_Hotline@epa.gov

1-888-546-8740

1-202-566-2599

http://www.epa.gov/oig/hotline.htm

EPA Inspector General Hotline 

1200 Pennsylvania Avenue, NW

Mailcode 2431T

Washington, DC 20460

email:

phone:

fax:

online:

write:

OIG_WEBCOMMENTS@epa.gov

1-202-566-2391

1-202-566-2599

http://www.epa.gov/oig/contact.html#Full_Info

EPA Inspector General 

1200 Pennsylvania Avenue, NW

Mailcode 2410T

Washington, DC 20460
 

 14-P-0332

August 15, 2014

Why We Did This Review

We sought to determine 

whether the U.S. 

Environmental Protection

Agency (EPA) had: 

(1) implemented its cloud 

initiatives in accordance with 

the Federal Cloud Computing 

Strategy and associated 

requirements, and

(2) developed formal processes 

to monitor cloud vendors.

Cloud computing describes a 

broad movement to treat

information technology (IT) 

services as a commodity with 

the ability to dynamically 

increase or decrease capacity 

to match usage needs. In 

December 2010, the U.S. Chief 

Information Officer issued a 

“Cloud First” policy requiring 

that agencies default to cloudbased solutions for new IT

deployments whenever a 

secure, reliable and costeffective cloud option exists. 

This report addresses the 

following EPA goal or 

cross-agency strategy:

 Embracing EPA as a highperforming organization.

For further information, 

contact our public affairs office 

at (202) 566-2391.

The full report is at:

www.epa.gov/oig/reports/2014/ 

20140815-14-P-0332.pdf

Cloud Oversight Resulted in Unsubstantiated and

Missed Opportunities for Savings, Unused and 

Undelivered Services, and Incomplete Policies 

 What We Found

The EPA developed processes to monitor 

cloud vendors. However, controls for the 

EPA’s cloud computing initiatives are 

incomplete and need improvement. 

Specifically:

 The EPA’s cost-benefit analysis did not adhere with guidance. 

 The EPA paid full price for services not performed.

 The EPA entered into a cloud infrastructure contract that could not be used 

to host applications because it did not meet federal requirements. Further, 

there was no documented analysis to determine whether the EPA should 

continue with the contract.

 The EPA had not performed an analysis to determine whether it would be in 

the EPA’s best interest to convert its internal infrastructure to meet all of the 

National Institute of Standards and Technology essential characteristics of 

a cloud.

 The EPA’s Office of Environmental Information did not implement a strategy 

to evaluate the EPA’s entire portfolio of IT applications to determine which 

applications can be consolidated, retired or moved to the cloud. 

 The EPA's policies and procedures for moving to the cloud are incomplete 

and need improvement. 

As a result, the EPA paid $2.3 million for services that were not fully rendered or 

did not comply with federal requirements. Also, EPA management does not have 

reasonable assurance that the agency’s cloud initiatives will be effective, 

efficient, and in compliance with applicable laws and regulations.

 Recommendations and Planned Corrective Actions

We recommend that the Assistant Administrator for Environmental Information 

and Assistant Administrator for Administration and Resources Management 

undertake a number of corrective actions to address deficiencies in the EPA's 

cloud computing initiatives, including: improving related policies and procedures; 

providing additional training and oversight to contracting officers; performing 

documented cost benefit analyses that are in compliance with federal 

requirements; and implementing a strategy to perform a documented analysis of 

all the assets in the EPA’s IT portfolio to determine which assets should be 

consolidated, retired or moved to the cloud. The agency indicated it has taken 

action on two of the 11 recommendations. The remaining recommendations are 

considered unresolved pending the agency’s response to the final report.

U.S. Environmental Protection Agency

Office of Inspector General

At a Glance

Improved oversight could help 

the EPA achieve objectives for 

the millions spent for cloud 

services and identify potential 

cost savings.
August 15, 2014

MEMORANDUM

SUBJECT: Cloud Oversight Resulted in Unsubstantiated and Missed Opportunities for Savings, 

Unused and Undelivered Services, and Incomplete Policies

Report No. 14-P-0332

FROM: Arthur A. Elkins Jr.

TO: Renee Wynn, Acting Assistant Administrator and Chief Information Officer

Office of Environmental Information

Craig E. Hooks, Assistant Administrator

Office of Administration and Resources Management

This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the 

U.S. Environmental Protection Agency (EPA). This report contains findings that describe the problems 

the OIG has identified and corrective actions the OIG recommends. This report represents the opinion of 

the OIG and does not necessarily represent the final EPA position. Final determinations on matters in 

this report will be made by EPA managers in accordance with established audit resolution procedures.

The offices responsible for areas covered in this report include the Office of Administration and 

Resources Management’s (OARM’s) Office of Acquisition Management and the Office of 

Environmental Information’s (OEI’s) Office of Technology Operations and Planning.

Action Required

OARM indicated that it completed agreed-upon corrective actions associated with recommendations 2

and 7 and we are closing those recommendations in our audit tracking system upon issuance of this 

report. OEI’s responses for the remaining nine recommendations did not provide sufficient information 

on intended corrective actions to allow us to properly determine whether the intent of these

recommendations was satisfied. These recommendations will remain unresolved until OEI provides 

planned corrective actions in response to the final report.

In accordance with EPA Manual 2750, OEI is required to provide a written response to this report within 

60 calendar days. OEI should include planned corrective actions and completion dates for all unresolved 

recommendations. OEI’s response will be posted on the OIG’s public website, along with our 

memorandum commenting on OEI’s response. OEI’s response should be provided as an Adobe PDF file 

that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as 

amended. The final response should not contain data that should not be released to the public; if the

response contains such data, OEI should identify the data for redaction or removal along with 

corresponding justification.

We will post this report to our website at http://www.epa.gov/oig. 

THE INSPECTOR GENERAL

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY

WASHINGTON, D.C. 20460
Cloud Oversight Resulted in Unsubstantiated and 14-P-0332

Missed Opportunities for Savings, Unused and

Undelivered Services, and Incomplete Policies

-continuedTable of Contents

Chapters

1 Introduction ......................................................................................................... 1

Purpose ..................................................................................................... 1

Background................................................................................................ 1

Scope and Methodology ............................................................................ 3

2 Improvements Needed in Email Cloud Implementation.................................... 5

Improvements Needed for Email Cloud Analysis........................................ 5

EPA Paid for Email and Collaboration Moving Services Not Received....... 6

Conclusions ............................................................................................... 7

Recommendations..................................................................................... 8

Agency Response to Draft Report and OIG Evaluation.............................. 8

3 Improvements Needed in Infrastructure-as-a-Service

Cloud Implementation......................................................................................... 10

IaaS Cloud Contract Could Not Be Utilized to Host Applications ................ 10

Analysis for Continued Use of IaaS Needs to Be Performed ..................... 12

Conclusions ............................................................................................... 14

Recommendations..................................................................................... 14

Agency Response to Draft Report and OIG Evaluation.............................. 15

4 OEI Did Not Evaluate Whether Applications Could Be 

Retired, Consolidated and Moved to the Cloud................................................. 16

OEI Did Not Evaluate Applications for Retirement, 

 Consolidation and Cloud Migration...................................................... 16

Conclusions ............................................................................................... 17

Recommendations..................................................................................... 18

Agency Response to Draft Report and OIG Evaluation.............................. 18

5 Improvements Needed in Documented Processes for 

 Cloud Implementation......................................................................................... 19

Cloud Computing Policies and Procedures Need Improvement ................. 19

Conclusions ............................................................................................... 20

Recommendation....................................................................................... 21

Agency Response to Draft Report and OIG Evaluation.............................. 21

Status of Recommendations and Potential Monetary Benefits ............................. 22
Cloud Oversight Resulted in Unsubstantiated and 14-P-0332

Missed Opportunities for Savings, Unused and

Undelivered Services, and Incomplete Policies

Appendices

A OEI Response to Draft Report and OIG Comment ......................................... 24

B OARM Response to Draft Report and OIG Comment..................................... 32

C Distribution ....................................................................................................... 37
14-P-0332 1

Chapter 1

Introduction

Purpose 

We sought to determine whether the U.S. Environmental Protection Agency (EPA) 

had: (1) implemented its cloud initiatives in accordance with the Federal Cloud 

Computing Strategy and associated requirements, and (2) developed formal 

processes to monitor cloud vendors.

Background

In December 2010, the U.S. Chief Information Officer (CIO) issued a 

“Cloud First” policy within the 25-Point Implementation Plan to Reform Federal 

Information Technology Management published by the White House. In 

February 2011, the U.S. CIO also issued the Federal Cloud Computing Strategy 

that identified cloud computing as having the potential to play a major part in 

achieving efficiencies in the federal government’s information technology (IT)

environment. Efficiencies potentially improved by cloud computing include asset 

utilization and the reduction of duplicative systems. 

According to the National Institute of Standards and Technology (NIST), cloud 

computing is a model for enabling convenient, on-demand network access to a 

shared pool of configurable computing resources—such as computer servers, 

storage, software applications and Web services—that can be provisioned and 

released with minimal management effort or service provider interactions. 

In other words, in a cloud environment, IT resources are available to users as 

needed using a pay-as-you-go business model. 

The Government Accountability Office has indicated that cloud computing can 

potentially provide several benefits over current systems, including faster 

deployment of computing resources, a decreased need to buy hardware or build 

data centers, and more robust collaboration capabilities. Per the Federal Cloud 

Computing Strategy, cloud computing can also: 

 Provide lower individual usage costs and centralize infrastructure costs via 

realized economies of scale.

 Allow users to pay for what they consume. 

 Allow users to increase or decrease their usage.

 Leverage the shared underlying resources.
14-P-0332 2

Responsible Offices

The EPA’s Office of Environmental Information (OEI) and Office of 

Administration and Resources Management (OARM) have key responsibilities 

regarding the EPA’s migration to the cloud. Within those two offices: 

 OEI’s Office of Technology Operations and Planning provides technology 

services and manages the EPA’s IT investments and infrastructure. The 

Office of Technology Operations and Planning oversees IT operations and 

security (including IT investment management), enterprise architecture, 

application development and hosting, high performance computing, and 

development of policies and standards to guide IT expenditures and 

operations.

 OARM’s Office of Acquisition Management is responsible for planning, 

awarding and administering contracts for the agency, including issuing 

and interpreting acquisition regulations, administering training for 

contracting and program acquisition personnel, providing advice and 

oversight to regional procurement offices, and providing IT improvements 

for acquisition.

Guidance Issued

On January 24, 2011, the EPA’s Assistant Administrator for OEI (the EPA’s CIO)

issued a memorandum in reference to the 25-Point Implementation Plan to Reform 

Federal Information Technology Management published by the White House. The 

memorandum established OEI’s National Computer Center (NCC) as the agency’s 

focal point for acquiring cloud solutions and appointed OEI as the lead for 

developing a cloud computing strategy for both private and public cloud usage. 

Although the memorandum indicated that the NCC is the focal point for acquiring 

cloud solutions, OEI indicated that this is only limited to efforts to provide cloud 

services via the EPA’s internal private cloud services provided by the NCC and 

external cloud services obtained by the NCC via the General Services 

Administration (GSA) Infrastructure-as-a-Service (IaaS) Bulk Purchase Agreement.

The EPA’s Assistant Administrator for OEI and CIO issued a memorandum on 

Cloud Computer Services Security Requirements on September 6, 2011, to provide 

information for when considering cloud computing solutions. The memo indicates 

that the EPA needs to conduct control assessments on cloud provider systems to 

determine what, if any, controls need to be implemented by the provider or by the 

EPA. This memo also indicates that systems used by cloud providers shall obtain 

an Authorization to Operate by an EPA official before EPA information is stored, 

processed or transmitted on the systems.

Additionally, the EPA’s CIO approved a System Life Cycle Management Policy 

and Procedure on September 21, 2012. The policy applies to systems developed on 

behalf of the EPA by vendors irrespective of where the IT systems are hosted, 
14-P-0332 3

including cloud-based solutions. The System Life Cycle Management Procedure 

also indicated that if the application will be hosted in a cloud-based environment 

the system must adhere to the additional controls published by the Federal Risk and 

Authorization Management Program.1 

The EPA also issued Enterprise Roadmap 2012, which states that in fiscal year 

(FY) 2012 all of the EPA will be able to obtain cloud computing services from a 

GSA-authorized external cloud services vendor authorized for low-sensitivity 

applications and an EPA-hosted private cloud authorized for medium-sensitivity 

applications. The Roadmap indicated that OEI will provide support for evaluating 

cloud computing alternatives as part of the Capital Planning and Investment 

Control process, and will assist transitioning agency applications into the cloud 

computing infrastructure. Furthermore, the Roadmap stated that the EPA will 

default to cloud-based solutions whenever a secure, reliable and cost-effective 

cloud option exists.

Scope and Methodology

We performed this audit from January 2013 to April 2014 at the EPA 

headquarters in Washington, D.C.2 We performed this audit in accordance with 

generally accepted government auditing standards. Those standards require that 

we plan and perform the audit to obtain sufficient and appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on the audit 

objectives. We believe that the evidence obtained provides a reasonable basis for 

our findings and conclusions based on our audit objectives.

As a part of this review, we looked at the following two EPA cloud initiatives:

1. My Workplace: OEI awarded a vendor a contract to provide Softwareas-a-Solution for an email and collaboration suite. This contract also 

requires the vendor to provide support for OEI’s internal infrastructure 

used to host internal email and other applications. OEI has indicated that 

this infrastructure will not go away before 2019. Services provided by 

My Workplace include email, calendar, contacts, collaborative document 

editing and workspaces, Web conferencing, and other collaboration 

activities.

2. IaaS contract: The OEI awarded its IaaS contract through a GSA Blanket 

Purchase Agreement. The EPA plans to use this IaaS contract to make cloud 

 

1 The Federal Risk and Authorization Management program is a governmentwide program that provides a 

standardized approach to security assessment, authorization, and continuous monitoring for cloud products and 

services.

2 The audit was performed in Washington, D.C., but we conducted video and telephone interviews with EPA points 

of contact who are located in North Carolina. 
14-P-0332 4

computing resources available agencywide for low-sensitivity applications

through the EPA’s Working Capital Fund. 

We reviewed the EPA’s policies and procedures related to cloud computing to 

determine whether they were aligned and implemented in accordance with federal 

cloud computing policies. We limited the review of the My Workplace and IaaS 

initiatives to: (1) planning of the projects, and (2) the extent of the use of these 

cloud initiatives. We did not perform detailed reviews of the associated contracts. 

We made inquiries to EPA regions and program offices to collect information 

related to their plans for migrating applications from the EPA’s infrastructure that 

was used to host internal email. We analyzed the agency’s key cloud computing 

documents and related documentation. We examined the Federal Acquisition 

Regulation (FAR) and guidance published by the Office of Management and 

Budget (OMB) and NIST to gain an understanding of federal cloud computing 

recommendations and requirements.

Further, we interviewed and collected documentation from OARM’s Office of 

Acquisition Management and OEI’s Office of Technology Operations and Planning

management and staff responsible for planning, procuring, maintaining and 

monitoring the agency’s cloud computing services. We found no significant 

deficiencies associated with the EPA’s monitoring of the cloud vendors.
14-P-0332 5

Chapter 2

Improvements Needed in Email Cloud Implementation

The EPA’s cost-benefit analysis of and modifications for the agency’s email 

cloud computing implementation was not performed in compliance with EPA and 

federal guidance. OMB Circular A-94 Revised indicates that a cost-benefit 

analysis is recommended as the technique to use in a formal economic analysis of 

government programs and projects.3 The cost-benefit analysis included in-house 

costs normally excluded. Also, the OARM contracting officer did not negotiate 

and issue a written modification prior to performance and did not seek an 

equitable reduction in price to the contract for work not performed as specified in 

the contract, as required by the FAR.

4 As a result, by including costs that would 

not normally be considered in a cost-benefit analysis, it is questionable whether 

the agency will realize the estimated savings used to justify moving email to the 

cloud. Additionally, inaction by the contracting officer resulted in the agency 

paying for services it did not receive.

Improvements Needed for Email Cloud Analysis

The EPA’s cost-benefit analysis, included in the Collaborative Tools in the Cloud 

Business Case Presentation for migrating email and collaborative tools, dated 

April 2012, did not adhere with EPA and federal guidance. Table 1 shows the 

estimated costs OEI used in 2012 to justify its decision for not keeping email 

services in house and migrating email to the cloud. Using OEI’s cost-benefit

analysis, there is an estimated savings of $3,481,000, based on FY 2012 estimated 

costs derived from the Working Capital Fund billing rates as of April 2012. 

Table 1: OEI estimated cost projections FY 2013 FY 2014 FY 2015 Totals

OEI’s estimated costs for keeping email 

services in house in FY 2012 $12,061,000 $12,061,000 $12,061,000 $36,183,000

OEI’s estimated costs for moving email to 

the cloud 14,221,000 9,454,000 9,027,000 32,702,000

OEI’s estimated savings ($2,160,000) $2,607,000 $3,034,000 $3,481,000

Source: Information provided by OEI.

The EPA’s System Life Cycle Management Requirements Guidance refers to 

OMB Circular A-94 Revised for guidance when performing a cost-benefit 

analysis. OEI’s Business Case Presentation made April 2012 included the costbenefit analysis that used Working Capital Fund figures that included $2,142,000 

in hardware costs used in the estimated cost of keeping the email services 

 

3 See OMB Circular A-94 Revised Section 5.

4 The Code of Federal Regulations (CFR), in 48 CFR Subsections 42.302(b), 43.204(b)(2), 43.103, and 43.201.
14-P-0332 6

in-house. OEI representatives indicated that these hardware costs included costs 

for administrative support and sunk costs such as hardware depreciation.

Per OMB Circular A-94 Revised, these costs are not normally included and 

should be excluded from a cost-benefit analysis.5 The administrative cost is an 

indirect cost that cannot be assigned to one service but, rather, is a cost divided 

among all OEI services. Additionally, the depreciation cost reflects funds spent 

and is not a current cash expense. By including costs for the in-house alternative 

that would not normally be considered in a cost-benefit analysis, it is questionable 

whether the agency will realize the estimated savings indicated. Additionally, the 

cost-benefit analysis did not include a statement of the assumptions, the rationale 

behind them, and a review of strengths and weaknesses as required by OMB 

Circular A-94 Revised.6

OEI pointed out that it believed that the email and collaborative tools cloud 

initiative was an acquisition of commercial-type services by government or 

contractor operation and was exempt from OMB Circular A-94 Revised. That 

circular indicates that OMB Circular A-76 Revised is the guidance for the 

acquisition of commercial-type services by government or contractor operation.7

Subsequent to the issuance of the draft report, OEI indicated that it now believed 

OMB A-94 Revised was applicable. 

Since OEI did not perform a cost-benefit analysis that was in compliance with 

OMB guidelines, it is questionable whether the agency will realize its projected 

cost savings.

EPA Paid for Email and Collaboration Moving Services Not Received

The EPA paid for services not received on the contract to move the EPA’s email 

and collaboration services to the cloud. The contract, as modified, included the 

requirement for the vendor to transfer all the EPA’s email to the cloud within 

5 months of the award of the contract. 

After entering into the contract, OEI indicated that the vendor stated it could not 

transfer all of the email in the timeframe required by the contract. As a result, 

OARM’s contracting officer orally allowed the vendor to transfer only 30 days’ 

worth of email. Even though the vendor did not perform the work agreed to in the 

contract, the contracting officer did not issue a cure notice8or seek to renegotiate 

the price of the contract with an equitable reduction in price. 

In addition to paying the vendor full price for agreed-to services not performed as 

specified in the contract, the EPA is incurring additional costs for maintaining 

 

5 OMB Circular A-94 Revised Section 6 subsection a.

6 OMB Circular A-94 Revised Section 5 subsection c.3.

7 OMB Circular A-94 Revised Section 4 subsection b.2.

8 A cure notice notifies a vendor that it is in default of a contract. Cure notices specify failures and suggested cures. 
14-P-0332 7

emails not migrated to the cloud. OEI indicated the cost of maintaining the old 

email was low, but was unable to provide the Office of Inspector General (OIG)

with the annual cost. Additionally, OEI is planning to incur the annual cost of

providing employees with access to the email that was not moved off of the legacy 

email platform until at least FY 2019.

The FAR specifies that:

 Contracting officers are responsible for ensuring performance of all 

necessary actions for effective contracting, ensuring compliance with the 

terms of the contract and safeguarding the interests of the United States.9

 If repair/replacement or re-performance will not correct the defects or is not 

possible, the government may seek an equitable price reduction or adequate 

consideration for acceptance of nonconforming supplies or services.

10

 If the termination is predicated on the contractor failing to perform some 

of the other provisions of the contract (such as not furnishing a required 

performance bond) or so fails to make progress as to endanger 

performance of the contract, the contracting officer shall give the 

contractor written notice specifying the failure and providing a period of 

10 days (or longer period as necessary) in which to cure the failure. Upon 

expiration of the 10 days (or longer), the contracting officer may issue a 

notice of termination for default unless it is determined that the failure to 

perform has been cured.11

OARM’s contracting officer indicated that OEI did not request the negotiation of a 

lower price. As a result, the EPA paid full price for agreed-to services that were not 

performed as specified in the contract. In addition, the EPA has to incur additional 

costs of maintaining all email not transferred to the cloud on in-house systems until 

at least FY 2019. OEI was unable to provide the OIG with the cost of storing and 

providing access to the historic email that was not moved to the cloud.

Conclusions

It is questionable whether the agency will realize its projected cost savings because 

the EPA did not perform a documented cost-benefit analysis in compliance with 

OMB guidance. Additionally, the EPA paid for services not received and incurred 

additional expenses without a written modification to the contract and without 

seeking an equitable reduction in price. 

 

9 48 CFR subsection 1.602-2.

10 48 CFR subsection 52.212-4 (a).

11 48 CFR subsection 49.402-3 (d).
14-P-0332 8

Recommendations

We recommend that the Assistant Administrator for Environmental Information:

1. Develop and implement an internal independent oversight process to 

ensure that documented cost-benefit analyses are performed in compliance 

with the proper OMB circular prior to OEI outsourcing IT initiatives.

We recommend that the Assistant Administrator for Administration and 

Resources Management:

2. Develop and conduct training and provide oversight to help ensure 

contracting officers:

a. Issue cure notices when they become aware that a vendor will not 

meet its contractual obligations.

b. Negotiate equitable price reductions when vendors are not able to 

fulfill their contractual obligations. 

c. Add written amendments to contracts for all contract modifications.

Agency Response to Draft Report and OIG Evaluation

We received responses to the draft report from the OEI and OARM. Based on the OEI 

and OARM responses, we made changes as needed. Appendix A contains the OEI 

responses and appendix B contains the OARM responses, along with our comments.

OEI did not concur with recommendation 1 and offered an alternative recommendation. 

We did not accept the proposed alternative recommendation. OEI did not provide 

sufficient information to allow us to determine whether its intended action would satisfy 

the intent of our recommendation. However, based on discussions with the agency, we 

modified the recommendation to more clearly describe our intent. This recommendation 

is considered unresolved.

In the draft report, we made a recommendation that OARM determine the difference in 

cost between not moving all email to the cloud within the agreed-to time frames, as 

specified in the contract, and just moving 30 days of email, and seek an equitable 

reduction in price. We evaluated OARM’s comments and removed this recommendation 

because OARM indicated in its response to the draft report that it had issued a written 

modification for the change in scope subsequent to the OIG informing the Office of 

Acquisition Management that the contracting officer failed to obtain a written 

modification specifying that the contractor only move 30 days of email. This written 

modification was issued within a month after the OIG notified the Office of Acquisition

Management that the contracting officer failed to obtain the written modification for the 

change in scope—almost 7 months after the oral agreement was reached, and almost

5 months after the orally agreed-to change in scope was executed. We confirmed that the 
14-P-0332 9

agency took the stated actions. However, we were unable to verify that this modification 

would achieve the desired results due to the time constraints of the audit.

OARM concurred with the remaining recommendation OARM in this chapter

(recommendation 2). This recommendation is resolved and OARM indicated in its 

response to the draft report that it has taken actions to address the recommendation. 

However, due to time constraints, we were not able to validate that the actions achieved 

the desired results. 
14-P-0332 10

Chapter 3

Improvements Needed in 

Infrastructure-as-a-Service Cloud Implementation

The EPA entered into and approved payments for an Infrastructure-as-a-Service 

(IaaS) contract that the EPA was not able to utilize for hosting applications

because it did not meet federal requirements.

12 Additionally, OEI has not 

performed documented analyses to determine whether the EPA should continue 

with this IaaS contract and/or upgrade its internal infrastructure to meet all of the 

NIST essential characteristics of cloud computing. The OMB and FAR establish 

requirements when contracting for IT services such as cloud services. OEI and 

OARM’s Office of Acquisition Management did not follow or were unaware of 

specific requirements that impacted contracts associated with the EPA’s cloud 

initiatives. As a result, there is no documentation to support whether it is in the 

EPA’s best interest to continue with the IaaS contract and/or upgrade its internal 

infrastructure to meet all of the NIST essential characteristics of cloud computing. 

IaaS Cloud Contract Could Not Be Utilized to Host Applications

The EPA entered into a contract with a GSA-approved external cloud provider for 

IaaS cloud computing services that could not be utilized to host applications

because the vendor’s cloud service did not meet the federal Trusted Internet 

Connections (TIC) and Internet Protocol version 6 (IPv6) requirements.13

Furthermore, the EPA’s information security procedures did not meet federal TIC 

requirements.14 Specifically, the procedure states that all remote access for 

moderate and high information systems be routed through a limited number of 

managed access control points and refers to OMB memorandums on the TIC. The 

EPA’s information security procedures contradict the TIC Reference Architecture 

Document version 2, which specifies that all external connections are secured 

through a TIC access point.15 The objectives of the TIC initiative are to optimize 

and standardize the security of individual external network connections currently 

in use by federal agencies, including connections to the Internet; and to improve 

the federal government’s security posture and incident response capability 

 

12 IaaS is a cloud infrastructure where the consumer is provided the capability to provision processing, storage, 

networks and other fundamental computing resources where the consumer is able to deploy and run arbitrary 

software, which can include operating systems and applications. The consumer does not manage or control the 

underlying cloud infrastructure but has control over operating systems, storage and deployed applications; and 

possibly limited control of select networking components (e.g., host firewalls). 

13 An Internet Protocol address is a unique number used to identify computers on a network. Internet Protocol 

version 4, which had a limited number of Internet Protocol addresses, has become depleted. IPv6 was developed to 

establish more levels of addressing hierarchy with a larger pool of Internet Protocol addresses.

14 Information Security-Interim Access Control Procedures V3.2 (CIO-2150.3-P-01.1).

15 The Department of Homeland Security’s Trusted Internet Connections (TIC) Reference Architecture Document 

Version 2.0 (September 1, 2011).
14-P-0332 11

through the reduction and consolidation of external connections and by providing 

enhanced monitoring and situational awareness of external network connections. 

The OIG concludes that entering into contracts and having procedures that do not 

comply with the TIC requirements puts the EPA at risk of not realizing the 

objectives of the initiative.

OMB Memorandum M-05-22 originally set June 2008 as the date by which all 

agencies’ infrastructures must use IPv6. Additionally, OMB Memorandum for 

Chief Information Officers of Executive Departments and Agencies: Transition to 

IPv6, dated September 28, 2010: 

 Extended the due date to the end of FY 2012 for public-facing servers and 

the end of FY 2014 for internal client applications that communicate with 

public Internet servers and supporting enterprise networks.

 Specified that all agencies ensure that agency procurements of networked 

IT comply with FAR requirements for use of the USGv6 Profile and Test 

Program for the completeness and quality of their IPv6 capabilities.16

Furthermore, the FAR states that a waiver is required from the agency’s CIO

when acquiring information technology that does not comply with IPv6.17

OEI representatives indicated that they were aware of and included the TIC 

requirement in their original Request for Quote package. However, based on 

questions received from the vendor community, OEI believed that there were no 

known solutions to enable TIC provisioning by the provider. OEI explained that it 

made the choice to remove the TIC requirement because OEI believed that the 

TIC Reference Architecture provided for the hosting of unrestricted access 

services without a TIC. OEI indicated that, subsequent to the award, the EPA’s 

CIO issued the Environmental Protection Agency Information Security Policy 

(CIO-2150.3) and associated procedures. OEI also indicated that the EPA’s 

Senior Agency Information Security Officer stated that these procedures require 

that all the EPA services—including unrestricted access services—must be 

accessed through the TIC. Although the EPA indicated it was properly advised, 

the Environmental Protection Agency Information Security Policy only indicates 

that all remote access for moderate and high information systems and not all 

external connections, as required by OMB, must be routed through a limited 

number of managed access control points.

OEI indicated that it requested IPv6 capability in the Performance Work 

Statement within the original Request for Quote package. However, OEI stated 

that the vendor indicated that it could not support IPv6 because the vendor had not 

implemented IPv6 across its external cloud services but that the vendor 

 

16 USGv6 is the name provided by NIST to the development of the technical infrastructure necessary to support 

wide-scale adoption of IPv6 in the U.S. government.

17 48 CFR subsection 11.002(g).
14-P-0332 12

committed to providing an IPv6-compliant release by the end of 2013. In addition, 

the contracting officer was unaware that a waiver needed to be issued by the CIO 

prior to entering into contracts that did not meet the requirements for use of the 

USGv6 Profile and Test Program for the completeness and quality of their IPv6 

capabilities. The Office of Acquisition Management indicated that better training 

could have made the contracting officer aware of the FAR’s IPv6 requirements 

and oversight may have detected the error.

The EPA incurred costs on the contract that could not be utilized for hosting 

applications until a solution for TIC and IPv6 requirements were met. 

We obtained all the invoices for the vendor’s cloud environment. As of March 

2014, the EPA incurred approved invoices associated with this contract totaling 

$74,241 from July 6, 2012, to March 29, 2013. OEI indicated that the vendor's 

cloud environment has been made to be IPv6 compliant and that traffic has been 

routed through the EPA TIC; additionally, OEI has indicated that its Office of 

Information Collection placed an application into production in the vendor’s 

cloud environment in March 2014. OEI indicated that there has been no activity 

on the IaaS Cloud contract since last year, that the system was only placed in 

production in March 2014, and that no invoice has yet been submitted for 

payment for this activity by the vendor. 

Analysis for Continued Use of IaaS Needs to Be Performed 

OEI did not perform an analysis to determine whether it should continue with the 

IaaS contract or use the resources for the external IaaS cloud environment on 

other initiatives. Additionally, OEI has not performed an analysis for turning its 

internal hosting into an internal private cloud that meets all of the NIST essential 

characteristics of cloud computing. 

On June 25, 2012, the EPA entered into a contract with a GSA-approved external 

cloud provider for IaaS cloud computing services without performing a 

cost-benefit analysis. Instead, OEI indicated that it pursued an indefinite 

delivery/indefinite quantity contract to minimize its risk and cost exposure while 

providing an opportunity to explore external cloud service options for the EPA. 

OEI representatives indicated that the EPA wanted to provide its customers with 

an external cloud option to supplement the EPA’s internal hosting services, which 

OEI referred to as a private cloud. The EPA renewed the contract for a second 

year.

OEI indicated that to use the external cloud service offering, the application 

owners would have to incur additional costs for OEI to develop services not 

offered by the cloud provider and/or pay additional costs for premium services 

offered by the cloud provider. OEI indicated that the costs of these services are

already included in the cost for hosting applications using the EPA’s internal 

hosting services. On April 25, 2013 (10 months into the contract which OEI 

renewed), an OEI representative indicated that they:
14-P-0332 13

 Now have a “pretty” clear understanding of the integration requirements, 

obstacles and/or gaps in capabilities associated with using the vendor’s 

cloud offering. 

 Believed that given the additional costs necessary to address the gaps in 

the vendor’s cloud offering, the cost of the vendor’s cloud services would 

likely be equal to or greater than the cost to use the EPA’s National 

Computer Center internal services.

OEI also indicated that the EPA’s internal hosting environment did not meet all of 

the essential characteristics of cloud computing as defined by NIST. OEI did not 

perform a documented analysis to determine whether it would be in the EPA’s 

best interest to:

 Convert the internal infrastructure to meet all of the NIST essential 

characteristics of cloud computing.

 Continue operating as is without meeting the “on-demand self-service” 

NIST characteristic of cloud computing.

OMB Circular A-130 Revised indicates that agencies will integrate planning for 

information systems with plans for resource allocation and use, including 

budgeting, acquisition and use of information technology.18

Reason for not performing a cost-benefit analysis for using an external 

vendor’s cloud services: OEI indicated that it did not do a cost-benefit analysis 

associated with the vendor’s contract for external cloud services because, when 

pursuing the contract, OEI understood that the federal cloud services landscape 

was relatively immature and evolving. Instead, OEI indicated that it pursued an 

indefinite delivery/indefinite quantity contract to minimize its risk and cost 

exposure while providing an opportunity to explore external cloud service options 

for the EPA.

Reason for not performing cost-benefit analysis to convert its internal 

infrastructure services to meet all of the NIST essential characteristics of 

cloud computing: OEI indicated that it believed, based on its experience, that: 

 Establishing self-service tools for the NCC private cloud services would 

require a substantial investment that would not be cost effective for its 

limited market.

 The integration of self-service IT resource allocation with Federal 

Information Security Management Act authorization and financial 

accountability would require a complex customization and ongoing 

maintenance in addition to a commercial off-the-shelf tool investment.

 

18 OMB Circular A-130 Revised Section 8 Subsection a.(e).
14-P-0332 14

 There has been a low volume of requests for new servers and/or changes 

to resource allocations and OEI believed that making an investment in 

large-scale self service was not practical.

By not performing these analyses, the EPA does not know whether it would be 

more beneficial to:

 Continue with the IaaS contract (including the investments the EPA would 

have to make to address the integration requirements, obstacles and gaps 

identified) or use the resources for the external IaaS cloud environment on 

other initiatives. 

 Continue using the internal hosting services as-is or upgrade them to meet 

all the NIST characteristics of the cloud computing environment

Conclusions

The EPA entered into contracts for cloud computing services without being aware 

of or following specific federal requirements. As a result, the EPA entered into and 

paid for a contract that the EPA was not able to utilize for hosting applications until 

21 months after the contract was signed.

Recommendations

We recommend that the Assistant Administrator for Environmental Information:

3. Perform a formal documented analysis to determine whether it is in the 

EPA’s best interest to continue with the IaaS contract or free the financial 

resources (including the investments the EPA would have to make to 

address integration requirements, obstacles and gaps identified) for other 

uses. 

4. Prior to entering into any future IaaS contracts, perform a formal 

documented analysis to determine whether such contracts are in the EPA’s 

best interest that includes the investments the EPA would have to make to 

address integration requirements, obstacles and gaps identified as a result 

of the current IaaS contract.

5. Modify the Information Security-Interim Access Control Procedures to 

adhere to the TIC Reference Architecture Document, which specifies that 

all external connections are secured through a TIC access point. 

6. Perform a formal documented analysis to determine whether it is in the 

EPA’s best interest to continue using the internal hosting services as-is or 
14-P-0332 15

to upgrade them to establish an internal private cloud that meets all 

characteristics of the NIST definition of a cloud. 

We recommend that the Assistant Administrator for Administration and 

Resources Management:

7. Establish guidance, formal oversight processes and training to ensure that 

the requirements for use of the USGv6 Profile and Test Program for the 

completeness and quality of their IPv6 capabilities are met within all 

applicable IT contracts or that a waiver is obtained from the EPA’s CIO 

prior to issuing an applicable IT contract that does not meet the 

requirements, as required by the FAR. 

Agency Response to Draft Report and OIG Evaluation

We received responses to the draft report from the OEI and OARM and made 

changes as needed. Appendix A contains the OEI responses and appendix B 

contains the OARM responses, along with our comments.

OEI concurred with the recommendations in this chapter. However, OEI did not 

provide sufficient information to allow us to determine whether its intended 

actions would satisfy the intent of our recommendations, and we consider those 

recommendations unresolved.

OARM concurred with recommendation 7. This recommendation is resolved and 

OARM indicated in its response to the draft report that it has taken actions to 

address the recommendation. However, due to the time constraints of the audit, 

we did not verify that the actions effectively corrected the deficiency.
14-P-0332 16

Chapter 4

OEI Did Not Evaluate Whether Applications Could Be 

Retired, Consolidated and Moved to the Cloud

The EPA did not fully develop or implement a strategy to evaluate the EPA’s 

entire portfolio of IT applications to determine which applications can be 

consolidated, retired or moved to the cloud. The Federal Cloud Computing 

Strategy indicates that successful organizations carefully consider their broad IT 

portfolios and create roadmaps for cloud deployment and migration. OMB 

Memorandum M-11-29 states that agency CIOs must focus on eliminating 

duplication and rationalize their agency’s IT investments.19 OEI representatives 

indicated that they believed the responsibility for managing the assets in the 

agency’s IT portfolio belonged to the agency’s program and regional offices and 

not OEI. The EPA may not realize efficiencies that could be obtained by 

developing and implementing a strategy to evaluate the EPA’s entire portfolio of 

IT applications to determine which applications can be consolidated, retired or 

moved to the cloud. 

OEI Did Not Evaluate Applications for Retirement, Consolidation and 

Cloud Migration

The EPA had not fully developed a strategy to evaluate applications for 

consolidating similar assets; retiring assets that have reached their end of life; and 

utilizing the cloud whenever a secure, reliable and cost-effective cloud option 

exists. The OEI indicated that:

 The platform, used to support internal email, would not go away before

FY 2019. Furthermore, OEI indicated that the platform that supported 

internal email also supported numerous agency-developed and commercial 

applications. OEI’s plan focused only on moving the email component.

 OEI performed an analysis that determined that moving email to the cloud 

would not negatively impact the applications that remained on the 

platform also used for internal email.

 OEI did not have or implement a strategy to identify which applications 

can be consolidated, retired or moved to the cloud or another platform for 

the more than 6,000 active applications that remained on the platform used 

for internal email.

 

19 OMB Memorandum M-11-29 Point 2 Commodity IT.
14-P-0332 17

Creating roadmaps for cloud deployment and migration provides the EPA the 

opportunity to focus on eliminating duplicate IT investments as required by OMB 

Memorandum M-11-29. 

The EPA’s CIO and OEI have the responsibility to manage the EPA’s IT 

portfolio, but OEI representatives indicated that OEI does not manage the IT 

portfolio for the agency. OEI representatives indicated that OEI supports the 

Capital Planning and Investment Control, System Life Cycle Management, and 

Enterprise Architecture processes that support investment owners in considering 

cloud options. The U.S. Clinger-Cohen Act specifies that agencies’ CIOs are

responsible for promoting the effective and efficient design and operation of all 

major information resources management processes for the executive agency.

20

OMB Memorandum M-11-29 adds additional responsibilities to the CIO, 

including the responsibility over the entire IT portfolio for an agency, to the 

statutory responsibilities provided through the Clinger-Cohen Act. The EPA’s 

1200 Delegations Manual provides for the delegation of CIO responsibilities, 

including the responsibilities assigned to the CIO within the Clinger-Cohen Act. 

The manual did not specifically list instructions for the delegation of promoting 

the effective and efficient design and operation of all the agency’s major 

information resources or the CIO’s responsibility over the entire IT portfolio. The 

manual did indicate that the CIO’s responsibilities not specifically listed in the 

manual may be delegated to OEI’s office directors, who may only redelegate 

these authorities to the division director level or equivalent. 

By not evaluating the IT portfolio and creating roadmaps, the EPA may not 

realize efficiencies that could be obtained by moving to the cloud, consolidating 

similar assets, and retiring assets that have reached their end of life. These 

applications may have owners in different program offices. As a result, if not

managed centrally, there is an increased possibility that multiple systems 

performing similar functions would not be consolidated. This may result in the 

EPA missing the opportunity to reduce redundant costs. This analysis and 

associated roadmaps should not be limited to the applications remaining on the 

platform that supported internal email, but should be extended to the EPA’s entire 

IT portfolio.

Conclusions

The OMB Memorandum M-11-29 and Federal Cloud Computing Strategy 

provide guidance for consolidating IT assets and developing cloud roadmaps. By 

not centrally managing the EPA’s entire IT portfolio as a whole, the EPA could 

be missing the opportunity to reduce redundant costs.

 

20 40 U.S. Code Subtitle III subsection 11315(b)(3).
14-P-0332 18

Recommendations

We recommend that the Assistant Administrator for Environmental Information:

8. Develop and implement a strategy to perform a documented analysis of 

the applications remaining on the platform that supported the EPA’s 

internal email to determine which applications should be consolidated, 

retired and/or moved to the cloud or another platform.

9. Develop and implement a strategy to perform a documented analysis of 

all of the EPA’s applications to determine which applications should be 

consolidated, retired and/or moved to the cloud.

10. Create and follow a formal process to implement the consolidation, 

retirement and/or cloud migration of applications as identified in response 

to recommendations 8 and 9.

Agency Response to Draft Report and OIG Evaluation

We received a response to the draft report from the OEI and made changes as 

needed. Appendix A contains the OEI response along with our comments.

OEI did not concur with the recommendations in this chapter and offered alternate 

recommendations. We did not accept the proposed alternative recommendations.

OEI did not provide sufficient information to allow us to determine whether its

intended actions would satisfy the intent of our recommendations. Therefore, 

these recommendations are considered unresolved.
14-P-0332 19

Chapter 5

Improvements Needed in Documented Processes 

for Cloud Implementation

The EPA’s policies and procedures for moving to the cloud are incomplete and 

need improvement. OMB Circular A-123, Management’s Responsibility for 

Internal Control, specifies that management is responsible for developing and 

implementing effective internal controls, including policies and procedures.21

Although OEI recognized the need for these additional policies and procedures, 

it was not made a priority, resulting in OEI indicating during a briefing with the 

OIG that the additional policies and procedures were no longer needed. Without 

fully developed and implemented formal policies and procedures, EPA 

management does not have reasonable assurance that the agency’s migration to the 

cloud will be effective, efficient, and in compliance with applicable laws and 

regulations.

Cloud Computing Policies and Procedures Need Improvement

The EPA’s policies and procedures for cloud computing are incomplete and need 

improvement. The policies and procedures did not include guidance that should 

be included based on the 25 Point Implementation Plan to Reform Federal IT and 

Federal Cloud Computing Strategy. For example, the policies and procedures did 

not provide detailed instructions for application owners to use for:

 Assessing and classifying applications in the EPA’s IT portfolio for 

moving to the cloud

 Creating roadmaps for cloud deployment and migration.

 Evaluating whether a secure, reliable and cost-effective cloud option exists 

for all new applications and, if so, ensuring that a cloud-based solution is 

used.

The EPA has the following guidance documents which address cloud migration:

 Assistant Administrator and CIO Memorandum (January 2011) addressing 

the White House’s 25-Point Implementation Plan to Reform Federal 

Information Technology Management.

 Assistant Administrator and CIO Memorandum (September 2011) 

regarding Cloud Computing Services Security Requirements.

 System Life Cycle Management Policy and Procedure (September 2012).

 EPA Enterprise Roadmap 2012.

 

21 OMB Circular A-123 Sections I and IIC.
14-P-0332 20

Notwithstanding these documents, OEI recognized the need for additional policies 

and procedures associated with cloud computing. In OEI’s Quality Technology 

Subcommittee Briefing: EPA Cloud Computing Strategy Update, presented on 

July 21, 2011, OEI identified to EPA management the need to: 

 Develop readiness assessment criteria for applications to migrate to the 

cloud. 

 Assess all the EPA applications and develop a migration schedule for 

migrating to the cloud. 

In addition, as of May 2013, OEI also listed the development of a cloud policy as 

a medium priority on its policy agenda. This agenda indicated the description of 

this cloud policy was to cover the requirements for the EPA offices that wanted to 

use cloud-based solutions. In November 2013, OEI stated that the cloud policy on 

the agenda was no longer needed. While OEI believes this policy to no longer be 

necessary, management had not taken steps to include these improvements to the 

cloud policies and procedures previously listed or develop additional cloud 

policies and procedures. 

The Federal Cloud Computing Strategy and the 25 Point Implementation Plan to 

Reform Federal IT provide guidance for assessing if and when applications can be 

moved to the cloud based on readiness and value. For example, the strategy 

indicates that agencies should carefully consider their broad IT portfolios and 

create roadmaps for cloud deployment and migration. Additionally, the 25 Point 

Implementation Plan to Reform Federal IT requires that agencies default to cloudbased solutions for new IT deployments whenever a secure, reliable, costeffective cloud option exists.

Conclusions

The responsibility for developing internal controls, including policies and 

procedures, falls upon management. EPA management did not fulfill its 

responsibility when it did not develop complete policies and procedures for 

moving to the cloud. Improvements in documented processes for cloud 

implementation can minimize the waste of money and resources and help ensure 

that the EPA’s migration to the cloud adheres to IT laws and regulations. Without 

fully developed formal policies and procedures for migrating to the cloud, EPA 

management does not have reasonable assurance that the agency’s migration will 

be effective, efficient, and in compliance with applicable laws and regulations.
14-P-0332 21

Recommendation

We recommend that the Assistant Administrator for Environmental Information: 

11. Publish detailed instructions for agency programs to use when considering 

moving applications to the cloud that fully addresses federal guidance,

including but not limited to such areas as:

a. Assessing and classifying applications for cloud migration.

b. Creating cloud migration roadmaps.

c. Performing a documented analysis to determine whether a secure, 

reliable and cost-effective cloud option exists for all new 

applications. 

Agency Response to Draft Report and OIG Evaluation

OEI concurred with recommendation 11. However, OEI did not provide sufficient 

information to allow us to determine whether its intended actions would satisfy the intent 

of our recommendation. Therefore, the recommendation is considered unresolved.
14-P-0332 22

Status of Recommendations and 

Potential Monetary Benefits

RECOMMENDATIONS

POTENTIAL MONETARY 

BENEFITS (in $000s)

Rec. 

No.

Page 

No. Subject Status1 Action Official

Planned 

Completion 

Date

Claimed 

Amount

Agreed-To 

Amount

1 8 Develop and implement an internal independent 

oversight process to ensure that documented costbenefit analyses are performed in compliance with 

the proper OMB circular prior to OEI outsourcing IT 

initiatives.

U Assistant Administrator for 

Environmental Information

2 8 Develop and conduct training and provide oversight 

to help ensure contracting officers:

a. Issue cure notices when they become aware 

that a vendor will not meet its contractual 

obligations.

b. Negotiate equitable price reductions when 

vendors are not able to fulfill their contractual 

obligations. 

c. Add written amendments to contracts for all 

contract modifications.

C Assistant Administrator for 

Administration and 

Resources Management

12/19/13

3 14 Perform a formal documented analysis to 

determine whether it is in the EPA’s best interest to 

continue with the IaaS contract or free the financial 

resources (including the investments the EPA 

would have to make to address integration 

requirements, obstacles and gaps identified) for 

other uses. 

U Assistant Administrator for 

Environmental Information

4 14 Prior to entering into any future IaaS contracts, 

perform a formal documented analysis to 

determine whether such contracts are in the EPA’s 

best interest that includes the investments the EPA 

would have to make to address integration 

requirements, obstacles and gaps identified as a 

result of the current IaaS contract.

U Assistant Administrator for 

Environmental Information

5 14 Modify the Information Security-Interim Access 

Control Procedures to adhere to the TIC Reference 

Architecture Document, which specifies that all 

external connections are secured through a TIC 

access point.

U Assistant Administrator for 

Environmental Information

6 14 Perform a formal documented analysis to 

determine whether it is in the EPA’s best interest to 

continue using the internal hosting services as-is or 

to upgrade them to establish an internal private 

cloud that meets all characteristics of the NIST 

definition of a cloud.

U Assistant Administrator for 

Environmental Information

7 15 Establish guidance, formal oversight processes 

and training to ensure that the requirements for use 

of the USGv6 Profile and Test Program for the 

completeness and quality of their IPv6 capabilities 

are met within all applicable IT contracts or that a 

waiver is obtained from the EPA’s CIO prior to 

issuing an applicable IT contract that does not 

meet the requirements, as required by the FAR.

C Assistant Administrator for 

Administration and 

Resources Management

10/14/13
14-P-0332 23

RECOMMENDATIONS

POTENTIAL MONETARY 

BENEFITS (in $000s)

Rec. 

No.

Page 

No. Subject Status1 Action Official

Planned 

Completion 

Date

Claimed 

Amount

Agreed-To 

Amount

8 18 Develop and implement a strategy to perform a 

documented analysis of the applications remaining 

on the platform that supported the EPA’s internal 

email to determine which applications should be 

consolidated, retired and/or moved to the cloud or 

another platform.

U Assistant Administrator for 

Environmental Information

9 18 Develop and implement a strategy to perform a 

documented analysis of all of the EPA’s 

applications to determine which applications should 

be consolidated, retired and/or moved to the cloud.

U Assistant Administrator for 

Environmental Information

10 18 Create and follow a formal process to implement 

the consolidation, retirement and/or cloud migration 

of applications as identified in response to 

recommendations 8 and 9.

U Assistant Administrator for 

Environmental Information

11 21 Publish detailed instructions for agency programs 

to use when considering moving applications to the 

cloud that fully addresses federal guidance, 

including but not limited to such areas as:

a. Assessing and classifying applications for 

cloud migration.

b. Creating cloud migration roadmaps.

c. Performing a documented analysis to 

determine whether a secure, reliable and 

cost-effective cloud option exists for all new 

applications. 

U Assistant Administrator for 

Environmental Information

1 O = Recommendation is open with agreed-to corrective actions pending.

C = Recommendation is closed with all agreed-to actions completed.

U = Recommendation is unresolved with resolution efforts in progress.
14-P-0332 24

Appendix A 

OEI Response to Draft Report and OIG Comment

(June 4, 2014)

MEMORANDUM

SUBJECT: Response to Office of Inspector General Draft Report No. OA-FY13-0095, 

“Cloud Oversight Results in Unsubstantiated and Missed Opportunities for 

Savings, Unused and Undelivered Services, and Incomplete Policies,” dated April 

30, 2014

FROM: Renee P. Wynn /s/

 Acting Assistant Administrator and Chief Information Officer

TO: Arthur A. Elkins, Jr.

 Inspector General

Thank you for the opportunity to respond to the issues and recommendations in the subject draft 

audit report. Following is a summary of the Office of Environmental Information’s (OEI) 

overall position, along with its position on each of the draft report recommendations. For those 

draft report recommendations with which the OEI agrees, we have provided high-level intended 

corrective actions and estimated completion dates to the extent we can. For those report 

recommendations with which the OEI does not agree, we have explained our position and 

proposed alternatives to recommendations to the extent we can.

OEI’s Overall Position

The OEI recommends the title of the report be revised and believes some of the content of the 

report goes beyond the scope of the audit. The OEI concurs on five of the nine OEI 

recommendations. The OEI disagrees with four of the nine OEI recommendations. Please note 

that the Office of Administration and Resources Management provided their separate response to 

the Office of Inspector General.

Attached is OEI’s corrective action plan with additional details. If you have any questions or 

concerns about this response, please feel free to contact Harrell Watkins, Acting Director, Office 

of Technology Operations and Planning, at 202-566-0672.

Attachment
14-P-0332 25

OFFICE OF ENVIRONMENTAL INFORMATION (OEI) 

RESPONSE TO REPORT RECOMMENDATIONS

CORRECTIVE ACTION PLAN

OIG Draft Report No. OA-FY13-0095, “Cloud Oversight Results in Unsubstantiated and Missed 

Opportunities for Savings, Unused and Undelivered Services, and Incomplete Policies,” dated 

April 30, 2014.

Note: The Office of Administration and Resources Management has the lead to respond to OIG 

recommendations 2, 3, and 8 which is being provided separately to OIG.

AGREEMENTS

OIG Recommendation 4 (Lead Office: OEI/OTOP/NCC)

Perform a formal documented analysis to determine whether it is in the EPA’s best interest to continue 

with the IaaS contract or free the financial resources (including the investments the EPA would have to 

make to address integration requirements, obstacles and gaps identified) for other uses.

Corrective Action:

OEI Concurs on the Recommendation – OEI will perform a documented analysis on whether it is in the 

EPA’s best interest to continue with the IaaS contract.

Estimated Completion Date: 9/30/2014

Discussion of OIG Findings:

Chapter 3: Improvements needed in Infrastructure-as-a-Service Cloud Implementation

OEI does not agree with the conclusion reached in Chapter 3 that OEI was and is unable to use the 

contract for IaaS Cloud Services. OEI did use the contract for IaaS services and paid only for the services 

it used. 

Federal cloud computing was, and continues to be, an emerging and rapidly changing technology 

area. Likewise federal regulations and guidance governing information systems operations, security and 

procurement were and are evolving and changing to adapt to the cloud computing context. The 

combination of changing technology, regulations and guidance produce an implementation context of 

high uncertainty.

Given the context of uncertainty, OEI’s approach was prudent and productive. OEI pursued a contracting 

method (indefinite delivery with indefinite quantity) that allowed EPA to test and evaluate the provider’s 

IaaS cloud technologies and services at a reasonable cost while providing for expansion if or when it was 

needed. With this contract EPA pays only for the resources consumed with a $50,000 annual minimum. 

This methodology mitigated both costs and risks associated with exploring the emerging technology.

It is a recognized industry best practice to test and evaluate complex technologies prior to broad scale 

adoption. As noted in the audit, OEI consumed $74, 241 in services or $24,241 over the minimum annual 

amount. These costs incurred were reasonable costs for services consumed given the scope and 

OIG Comment: OEI indicated that it concurs with the recommendation, but its response did 

not provide sufficient information to allow us to determine whether its intended actions 

would satisfy the intent of our recommendation.
14-P-0332 26

complexity of the technology involved. OEI received tangible benefit from the hands-on experience 

gained by testing the technologies, methods and procedures used for deploying and operating systems 

within specific context of the provider’s IaaS cloud solution. Finally, as noted in the audit, the service 

provider mitigated the IPv6 deficiency within the time period provided by the contract and EPA is now 

hosting a production application using the services.

OIG Recommendation 5 (Lead Office: OEI/OTOP/NCC)

Prior to entering into any future IaaS contracts, perform a formal documented analysis to determine 

whether such contracts are in the EPA’s best interest. That includes the investments the EPA would have 

to make to address integration requirements, obstacles and gaps identified as a result of the current IaaS 

contract.

Corrective Action:

OEI Concurs on the Recommendation – OEI will perform a formal analysis to determine whether such 

contracts are in the EPA’s best interest prior to entering into any future IaaS contract.

Estimated Completion Date: TBD

OIG Recommendation 6 (Lead Office: OEI/SAISO)

Modify the Information Security-Interim Access Control Procedures to adhere to the TIC Reference 

Architecture Document, which specifies that all external connections are secured through a TIC access 

point.

Corrective Action:

OEI Concurs on the Recommendation – The SAISO is in the process of updating the interim control 

procedures to reflect NIST SP800-53 rev 4, and will ensure the AC procedure includes appropriate 

reference guidance from the Department of Homeland Security’s Trusted Internet Connections (TIC) 

Reference Architecture Document Version 2.0 (October 1, 2013).

Estimated Completion Date: 12/31/2014

OIG Recommendation 7 (Lead Office: OEI/OTOP/NCC)

Perform a documented analysis to determine whether it is in the EPA’s best interest to continue using the 

internal hosting services as-is or to upgrade them to establish an internal private cloud that meets all 

characteristics of the NIST definition of a cloud.

Corrective Action:

OEI concurs on the Recommendation – OEI will perform an analysis to determine whether it is in the 

EPA’s best interest to continue using the internal hosting as-is or to upgrade to an internal private cloud.

OIG Comment: OEI indicated that it concurs with the recommendation, but its response did 

not provide sufficient information to allow us to determine whether its intended actions 

would satisfy the intent of our recommendation.

OIG Comment: OEI indicated that it concurs with the recommendation, but its response did 

not provide sufficient information to allow us to determine whether its intended actions 

would satisfy the intent of our recommendation.
14-P-0332 27

Estimated Completion Date: 9/30/2014

OIG Recommendation 12 (Lead Office: OEI/OTOP/MISD)

Publish detailed instructions for agency programs to use when considering moving applications to the 

cloud that fully addresses federal guidance, including but not limited to such areas as:

a. Assessing and classifying applications for cloud migration.

b. Creating cloud migration roadmaps.

c. Performing a documented analysis to determine whether a secure, reliable and cost-effective cloud 

option exists for all new applications.

Corrective Action: 

OEI concurs that some specific guidance for helping assess whether migrating to the cloud is a viable 

option could be helpful to program managers. However, we would note that such guidance should be 

based not only on Federal policy, but on our own lessons learned. Thus we would put more emphasis on 

sub-items a and c, which focus on evaluating options, than on item b, which seems to indicate a 

preference for cloud migration. Our completion date will be contingent upon the evaluation of our 

lessons learned, which will continue through the SharePoint deployment set to launch in early summer. 

We also request clarification on whether the term “applications” under item c refers to applications as we 

have defined them in this document. 

Estimated Completion Date: 5/29/2015

Discussion of OIG Findings:

Chapter 5: Improvements Needed in Documented Process for Cloud Implementation

As noted in the comments to Chapter 4, it is not appropriate draft findings or to make recommendations 

concerning “applications in the EPA’s IT Portfolio.” Applications and the IT portfolio are different 

items, with different lifecycles and governance. Any guidance that OEI develops for cloud migration 

would likely have to provide tailoring differences for evaluating applications versus evaluating Capital 

Planning and Investment Control (CPIC) investments.

OIG Comment: OEI indicated that it concurs with the recommendation, but its response did 

not provide sufficient information to allow us to determine whether its intended actions 

would satisfy the intent of our recommendation.

.

OIG Comment: OEI indicated that it concurs with the recommendation, but its response did 

not provide sufficient information to allow us to determine whether its intended actions 

would satisfy the intent of our recommendation. In contrast to OEI’s definition of an 

application as being a generic term that refers to stand-alone software systems, NIST SP 800-

37 revision 1 defines an application as a software program hosted by an information system.
14-P-0332 28

DISAGREEMENTS

Report Title

OEI respectfully requests the OIG change the title of this report to more accurately reflect the purpose and 

nature of the findings of this audit. A suggested title is “Improvements Needed in Implementing Cloud 

Initiatives.”

Discussion of OIG Findings:

Chapter 4: OEI Did Not Evaluate Whether Applications Could Be Retired, Consolidated and Moved to 

the Cloud

Chapter 5: Improvements Needed in Documented Processes for Cloud Implementation

The OIG’s stated purpose for this audit was to determine whether EPA had 1) implemented its cloud 

initiatives in accordance with the Federal Cloud Computing Strategy and 2) developed formal processes 

to monitor cloud vendors. However, the OIG went on to include others in its report and recommendations 

area not associated with its stated purpose, see Chapter 4 “OEI Did Not Evaluate Whether Applications 

Could Be Retired, Consolidated and Moved to the Cloud” and Chapter 5 “Improvements Needed in 

Documented Processes for Cloud Implementation.” Chapter 4 discusses EPA’s overall information 

portfolio which in many cases was untouched by the move from Lotus Notes to a suite of Microsoft tools, 

including email. Chapter 5 focuses on EPA’s policies and procedures for moving to the cloud. The 

addition of this chapter was not covered by the purpose of the audit and should not be included in this 

report.

OIG Recommendation 1 (Lead Office: OEI/OTOP/MISD)

Develop and implement an internal independent oversight process to ensure that a justification for the use 

of either OMB Circular A-94 Revised or OMB Circular A-76 Revised is documented and that 

documented cost-benefit analyses are performed in compliance with the proper OMB circular prior to 

OEI outsourcing IT initiatives.

Explanation for Disagreement:

Following are the reasons OEI does not concur with this recommendation:

1. OMB Circular A-76 is not relevant to “outsourcing IT initiatives.” The purpose of OMB Circular A76 is to assess whether work performed by government staff is inherently governmental or whether it 

could be provided by the private sector. There is little to be gained by evaluating whether to conduct 

an A-76 analysis. 

OIG Comment: The Federal Cloud Computing Strategy indicates that cloud computing has 

the potential to address inefficiencies that negatively impact the federal government’s ability to 

serve the American public. These inefficiencies include: low asset utilization, a fragmented 

demand for resources, duplicative systems, environments which are difficult to manage, and 

long procurement lead times. We conclude this to mean that the management of IT investments 

to eliminate these inefficiencies is a part of the Federal Cloud Computing Strategy.

We conclude that the policies and procedures addressed in chapter 5 are essential for following 

federal cloud computing strategy. OMB Circular A-123 indicates that internal control activities 

such as policies and procedures help ensure that agency objectives, such as effectiveness and 

efficiency of operations and compliance with applicable laws and regulations, are met. 
14-P-0332 29

2. The phrase “outsourcing IT initiatives” is vague. We think it is appropriate to distinguish investment 

in the IT portfolio, which are subject to OMB’s CPIC process, from IT applications, which are much 

smaller programs and locally managed. The rigor needed for the cost analysis around an IT 

investment is much higher than the rigor needed for the cost analysis around an application. 

3. There are additional initiatives underway that lend guidance to how OEI should address cost 

estimating. 

a. In response to GAO-12-629, Information Technology Cost Estimation: Agencies Need to 

Address Significant Weaknesses in Policies and Practices, OEI has incorporated the GAO 

Cost Estimating and Assessment guide by reference into its System Life Cycle 

Management (SLCM) procedure for the definition phase. The GAO guide covers many 

of the elements listed in Circular A-94. However, while Circular A-94 is about 4 pages 

long, the GAO guide is almost 400 pages.

b. In support of its ongoing work with OMB’s PortfolioStat, EPA is expanding the role of 

its Information Investment Subcommittee to an Information Investment Review Board 

(IIRB). This board is chartered to mature investment and portfolio management within 

EPA. This would be the appropriate “internal independent” body to assess the level of 

rigor needed respectively for CPIC Major, Medium, Lite, and Small/Other investments.

Proposed Alternative:

OEI proposes that recommendation #1 be replaced with a recommendation that as one of its first-year 

objectives, the IIRB expand upon the text currently in the SLCM to provide minimum guidelines for cost 

estimates and cost-benefits analyses, based on the distinction between CPIC levels.

Discussion of OIG Findings:

Chapter 2: Improvements needed in Email Cloud Implementation.

This chapter includes a critique of the cost-benefit analysis developed in the business case that was used 

to make a decision whether to migrate email to the cloud. It states that the analysis “did not adhere with 

EPA and federal guidance22.” Specifically, the auditor calls out that the cost benefit analysis may include 

sunk costs, and that this is counter to the guidance in OMB Circular A-94.

OEI is not in complete agreement that the costs referred to by the auditor as sunk costs do completely 

represent sunk costs, as we believe they include capital refresh as well. Nonetheless, OEI acknowledges 

that given the tight timeframes around this project, the initial cost benefit analysis did not include all 

elements in the OMB A-94 guidelines. It was conducted to provide input to the decision whether to 

proceed; we understood that we would update the return on investment calculations as the project 

progressed.

 

22 We believe that in stating that OEI did not follow EPA guidance, the auditor is referring to the System Life Cycle 

Management (SLCM) policy. We would like to note that the initial cost estimate was conducted in April 2012, 

whereas the current policy was not signed until September 2012.

OIG Comment: OEI did not concur with this recommendation and offered an alternate 

recommendation. We did not accept the proposed alternative recommendation. OEI did not 

provide sufficient information to allow us to determine whether its intended actions would 

satisfy the intent of our recommendation.
14-P-0332 30

The report also faults the cost analysis on the premise that “OMB Circular A-76 indicates that the cost of 

contract performance should be based on the price to perform the requirements of the Performance Work 

Statement, as presented by the offeror to compete with the in-house workforce. OEI used estimates for 

migrating to the cloud and did not use the offeror’s price.” OEI considers this critique unfounded. First, 

we do not believe that OMB Circular A-76 is relevant to this transaction. This project replaced one 

commercial email system with another, and had nothing assessing whether the work performed was not 

inherently government and should be performed by the private sector. Second, the purpose of the cost 

benefit analysis was to inform the decision whether to move forward with the cloud migration; it thus 

preceded the acquisition activity, and could not have included the offeror’s price. The offeror’s price was 

later incorporated into an update of the initial analysis.

OIG Recommendation 9 (Lead Office: OEI/OTOP/MISD)

Develop and implement a strategy to perform a documented analysis of the assets remaining on the 

platform that supported the EPA’s internal email to determine which assets should be consolidated, 

retired and moved to the cloud or another platform.

Explanation for Disagreement:

OEI believes we need to take some time to document and consider lessons learned from our cloud 

migrations prior to starting the task of developing roadmaps. These lessons learned will be very helpful 

in addressing recommendation #12, “Publish detailed instructions for agency programs to use when 

considering moving applications to the cloud.” For example, we still need to assess SharePoint when it 

deploys, as it might provide a proper bed for the applications. We do concur with recommendation #12, 

and would consider that a precursor to addressing recommendations 9 – 11.

Proposed Alternative:

OEI proposes that we need to assess current lessons learned on cloud migration before mandating a full 

analysis of all applications for migration. For example, we need to assess the ability of SharePoint to host 

(and even evaluate) applications. We also believe that it is plausible that allowing the migration to 

happen organically via the application lifecycle process could be more to the agency’s advantage than 

evaluating all of them at once in order to create a single comprehensive roadmap. 

OIG Recommendation 10 (Lead Office: OEI/OTOP/MISD)

Develop and implement a strategy to perform a documented analysis of all the assets in the EPA’s IT 

portfolio to determine which assets should be consolidated, retired and moved to the cloud.

Explanation for Disagreement:

OEI does not concur, on the basis that this is a broad portfolio management initiative, broader than just 

cloud migration, and is being addressed separately via the new IIRB. The IIRB first-year objectives 

include a mandate from GAO to “identify criteria for identifying wasteful, low-value, or duplicative 

investments.” These criteria could include reference to whether cloud migrations have been considered. 

OIG Comment: OEI did not concur with this recommendation and offered an alternate 

recommendation. We did not accept the proposed alternative recommendation. OEI did not 

provide sufficient information to allow us to determine whether its intended actions would 

satisfy the intent of our recommendation.
14-P-0332 31

Proposed Alternative:

OEI proposes allowing the first-year objective of the IIRB to serve as a proxy for this recommendation.

OIG Recommendation 11 (Lead Office: OEI/OTOP/MISD)

Create and follow a roadmap to implement the consolidation, retirement and cloud migration of IT assets 

as identified in response to recommendations 9 and 10.

Explanation for Disagreement:

OEI would need to complete its proposed alternative responses to recommendations 9 and 10 before 

commenting on the appropriateness of this recommendation. We may find that this course of action is 

still appropriate, or we may identify an alternative course of action.

Discussion of OIG Findings:

Chapter 4: OEI Did Not Evaluate Whether Applications Could be Retired, Consolidated, and Moved to 

the Cloud

In order to comment on this chapter, OEI needs to reiterate the distinction between “applications” and the 

“IT portfolio.” These are two different items and are managed in different ways. The term “IT Portfolio” 

describes all CPIC major, medium, lite, and other investments. The IT portfolio currently consists of 

about 120 investments. It is managed by the IIRB (described above), and the IIRB is co-chaired by the 

Deputy CIO and the Deputy CFO. “Application” is a generic term that refers to stand-alone software 

systems, the bulk of which are home-grown and designed to meet specific, local needs. EPA evaluated 

over 6,000 applications to ensure that the migration of email to the cloud would not break their 

functionality. Applications are managed locally throughout their lifecycle and are not part of the “IT 

Portfolio” and its governance processes described above.

This is an important distinction because the report states on page 17 that “OEI representatives indicated 

that OEI does not manage the IT portfolio for the agency...” then goes on to refute that statement from a 

policy basis. The OEI representatives made this statement in the context of applications, which are not 

under IIRB governance, rather than the IT portfolio. OEI believes this paragraph is misleading and 

should be removed.

OIG Comment: OEI did not concur with this recommendation and offered an alternate 

recommendation. We did not accept the proposed alternative recommendation. OEI did not 

provide sufficient information to allow us to determine whether its intended actions would 

satisfy the intent of our recommendation.

OIG Comment: OEI did not concur with this recommendation and offered an alternate 

recommendation. We did not accept the proposed alternative recommendation. OEI did not 

provide sufficient information to allow us to determine whether its intended actions would 

satisfy the intent of our recommendation.

OIG Comment: OMB Memorandum M-13-09 indicates that “As the Federal government 

implements the reform agenda, it is changing the role of Agency Chief Information Officers 

(CIOs) away from just policy making and infrastructure maintenance, to encompass true 

portfolio management for all IT.” We conclude that IT portfolio includes all IT.
14-P-0332 32

Appendix B

OARM Response to Draft Report and OIG Comment

(May 30, 2014)

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY

WASHINGTON, D.C. 20460

MEMORANDUM

SUBJECT: Response to Revised Audit Report OA-FY13-0095: Cloud Oversight Resulted in 

Unsubstantiated and Missed Opportunities for Savings, Unused and Undelivered 

Services, and Incomplete Policies

FROM: Craig E. Hooks, Assistant Administrator

TO: Arthur A. Elkins, Jr.

 Inspector General

OARM has reviewed revised OIG audit OA-FYB-0095, and provides the following response to 

new and existing audit findings.

OARM Recommendations and Responses

Recommendation 2: Determine the difference in cost between not moving all the email to 

the cloud within the agreed-to time frames as specified in the contract and just moving 30 

days of email, and seek an equitable reduction in price.

OARM Response: In the draft report, the OIG described the scenario leading to the above 

recommendation as "after entering into the contract, OEI indicated that the vendor stated it could 

not transfer all of the e-mail in the timeframe required by the contract. As a result, OARM's 

Contacting Officer (CO) verbally allowed the vendor to transfer only 30 days' worth of e-mail. 

Even though the vendor did not perform the work agreed to in the contract the CO did not issue a 

cure notice or seek to renegotiate the 'price of the contract with an equitable reduction in price." 

The Office of Acquisition Management (OAM) does not believe these general statements 

accurately represent the circumstances that resulted in an authorized change order to the contract. 

Pursuant to the changes clause of the contract (FAR 52.243-1), the contracting officer is 

authorized to direct changes within the general scope of the contract (FAR 4 3.201). Moreover, 

in light of the fact that the contracting officer considered such changes to be within the scope of 

the changes clause, the terms and conditions relating to potential termination (e.g., issuance of a 

OFFICE OF

ADMINISTRATION

AND RESOURCES

MANAGEMENT
14-P-0332 33

show cause or cure notice) did not apply. With respect to the statement that the contracting 

officer did not seek to renegotiate the price of the contract with an equitable reduction in price, 

such a statement implies that a reduction in price is the only consideration that would be 

applicable and appropriate for contract changes. In fact, equitable adjustments resulting from 

contract changes can take various forms depending on the type of contract and the nature of such 

changes. For example, adequate consideration for authorized changes may, and in this case did, 

include the contractor absorbing increased costs it was required to incur for performance of the 

changed contract.

Contract EP-G12H-00522 was awarded to the vendor on September 14, 2012 in support of an 

EPA requirement to replace the current enterprise on premise e-mail, collaboration and 

Blackberry Enterprise solution, with a Software as a Service (SaaS) services and support 

contract. In accordance with the solicitation, the successful offer included a fixed-price four (4) 

month transition period during which email would be migrated from the old to the new software 

using a migration tool. As a result of subsequent EPA identified risks, modification 2 of the 

contract extended the migration period to five (5) months and adjusted the fixed-price by 

$112,359. In mid-December 2012, the vendor notified EPA that a latent defect in the proposed 

migration tool discovered during testing would severely protract the speed of the migration, from 

six (6) weeks to over two (2) years. With this notification, the EPA had three choices: (1) 

terminate the contract for default, (2) require the contractor to execute the migration over two 

years at no increase in contract price, or (3) negotiate an appropriate contract change. Contract 

termination was not an option as this requirement was mission critical. Extending the migration 

over two years was not an option as this approach would have resulted in the EPA continuing to 

use unsupported Lotus Notes software during the migration. Negotiation was the only viable 

approach to reaching a solution. As a result, the vendor proposed three solutions to this problem 

and the parties entered into negotiations. Each of the three proposed solutions included migration 

of all e-mail over extended timeframes (from four [4] to seven [7] months), and the vendor had 

already purchased a new migration tool proposed under one option. After considering the 

proposed solutions, EPA and the vendor negotiated a fourth solution, which required the vendor 

to migrate only 30 days of e-mail over a weekend. The migration was accomplished, and in 

January 2013 the vendor entered into discussions with the EPA on contract scope changes 

effected since award, which other than the afore-mentioned option four (4) solution included a 

new encryption solution, additional migration schedule changes and the need for additional help 

desk surge support, and Blackberry infrastructure changes driven by security considerations. 

Although the vendor indicated costs were associated with each scope change, the contractor did 

not file a claim for equitable adjustment for any increased costs incurred. Furthermore, specific 

to the negotiated option four (4) change, the vendor offered to provide up to three (3) additional 

e-mail administrators at no additional cost from January through August 2013 as consideration to 

the EPA for the scope change. Any of the costs associated with these changes could have been 

offset against costs incurred by EPA resulting from the change in migration scope. Negotiations 

continued between the parties and were ultimately settled in July 2013. In the negotiated 

solution, the CO and contractor agreed to an equitable settlement in which the Government 

would not be charged any increased costs incurred by the contractor for these changes. OAM 

believes the more detailed description of the events surrounding this procurement above 

demonstrate that: (1) the decision to transfer only 30 days of e-mail was documented on the 

record prior to the formal July 2013 contract modification, (2) a cure notice was not necessary as 
14-P-0332 34

the parties were in negotiations to resolve contract changes not governed by the terminations 

clause, and (3) the decision not to adjust the contract price was not frivolous but rather part of a 

well-considered, negotiated agreement.

It is important to note the EPA's need to maintain Lotus Notes resulted from drivers other than 

agency wide e-mail, as various agency offices were still using Lotus Notes databases. 

Consequently only a portion of Lotus Notes maintenance resulted from partial e-mail migration. 

Lastly, under modification four (4) to the contract the EPA negotiated consideration for the lack 

of required encryption functionality which is calculated on a monthly basis and has resulted in 

credits of approximately $42,000 to the Agency to date.

Finally, the July 2013 modification revises the Statement of Work to require the vendor to 

migrate the "Most recent 30 days of Email", and also states "In consideration of the modification 

agreed to herein as complete equitable adjustment based on the Contractor's revised proposal 

dated June 18, 2013, the Contractor hereby releases the Government from any and all liability 

under this contract for further equitable adjustments attributable to such facts or circumstances 

giving rise to the proposal referenced above. This release shall also apply to the additional 

changes made to the Statement of Objectives".

This language creates a complete and final equitable adjustment on the above-described contract 

change per FAR 43.204(c). As such, the Government has no legal basis to re-open negotiations 

on this subject.

OIG Comment: The OIG removed this recommendation because, subsequent to the OIG 

notifying the Office of Acquisition Management that the contracting officer had never issued 

a written modification associated with the oral agreement, the Office of Acquisition 

Management issued a written modification which included this scope change. 

OARM’s response to the draft report indicated that the Office of Acquisition Management

and the contractor signed a formal (written) modification in July 2013 (subsequent to the OIG 

informing the Office of Acquisition Management that there was no written modification), 

that included reducing the amount of email to be migrated by the vendor to only the most 

recent 30 days of email and included language waiving EPA’s right for further equitable 

adjustment for this modification. Additionally, the Office of Acquisition Management’s

response indicated that the vendor claimed that there were costs associated with other scope 

changes (including a new encryption solution, additional migration schedule changes and the 

need for additional help desk surge support, and Blackberry infrastructure changes driven by 

security considerations) for which the contractor did not file a claim for an equitable 

adjustment. Further, according to the actual modification, this modification changed the 

incremental funded amount from $3,427,891 to $3,573,891.

The OIG was unable to verify that the modification would achieve the desired results due to 

the time constraints of the audit.
14-P-0332 35

Recommendation 3: Develop training and oversight to help ensure contracting officers:

a. Issue cure notices when they become aware that a vendor will not meet its 

contractual obligations.

b. Negotiate equitable reductions when vendors are not able to fulfill their 

contractual obligations.

c. Add written amendments to contracts for all contract modifications.

OARM Response: OARM agrees with these recommendations as sufficient regulatory and 

policy guidance already exists in FAR Part 49 on Cure Notices, and in FAR Parts 43 and 49, and 

CMM Part 42 on Equitable Adjustments. To perform oversight and compliance with these 

policies, OAM will identify contractor performance issues as a critical focus area for future 

contracting activity under the self-assessment and peer review components of the BSC PMMP.

With regard to contract file documentation, OAM has self-identified inadequate file 

documentation as a recurring finding under the BSC PMMP Peer Review program, and has 

directed a number of corrective actions, including the institution of more robust internal control 

reviews of procurement transactions. Policy that has already been updated to foster improvement 

in this area includes the attached excerpts from the OAM Acquisition Handbook ''Update to 

Acquisition Handbook 4.1 Reviews, Concurrences, and Checklists" (entire document at 

http://oarnintra.epa.gov/node/47, and updated via Interim Policy Notice (IPN) 12-03 

"Acquisition Planning" at http://oamintraepagov/node/8?q=node/158), which Contract Checklists 

of documents to be filed in the official contract file. Again, OAM will continue to use the selfassessment and peer review components of the BSC PMMP to monitor compliance with these 

policies. IPN 12-03 was published on October 14, 2013, and Acquisition Handbook 4.1 was 

published on December 19, 2013, which may be used as the corrective action completion date 

for this recommendations.

Furthermore, several initiatives resulting from OAM's Contract Management Assessment 

Program (CMAP) Peer Reviews, as well as OARM's Centers of Expertise in contracting

initiative, will establish new or improved functional requirements in this area. These include 

establishing independent business clearance reviews of pre- and post-award actions, and 

heightened accountability for obtaining and retaining delegations of contracting authority. 

Additionally, a BSC initiative on contract management planning has been developed in FY 2014 

to identify process improvements, policies and other tools to improve both contract file 

documentation and administration activities. To perform oversight, again OAM will use the selfassessment and peer review components of the BSC PMMP to monitor and report on compliance 

with applicable regulations, policies, and guidance. OAM oversight activities are ongoing.

OIG Comment: OARM agreed to the recommendation and indicated in its response to the 

draft report that it has taken actions to address this recommendation. However, due to the 

time constraints of the audit, we were not able to validate that the actions achieved the 

desired results.
14-P-0332 36

Recommendation 8: Establish formal oversight processes and training to ensure that the 

requirements for use of the USGv6 Profile and Test Program for the completeness and 

quality of their 1Pv6 capabilities are met within all applicable IT contracts or that a waiver 

is obtained from the CIO prior to issuing an applicable IT contract that does not meet the 

requirements, as required by FAR.

OARM Response: OARM agrees with this recommendation. Although supporting 

documentation for this procurement indicates the CIO relieved solicitation compliance 

requirements as a result of market research indicating there were no solutions to the technical 

requirement, and was also aware the awardee would not be in compliance until September 2013, 

the FAR requires a waiver. Subsequent to the award of this contract, OAM issued Interim Policy 

Notice (IPN) 12-03, "Acquisition Planning" at http://oamintra.epa.gov/node/8?q=node/158, 

which implements a robust acquisition planning process including use of an acquisition planning 

team to conduct planning in support of all procurements above the simplified acquisition 

threshold. Under IPN 12-03, pre-award acquisition planning on information technology (IT) 

requirements includes discussions to ensure these requirements are solicited and the file 

documented in accordance with applicable regulations, policy and guidance, and OAM uses the 

self-assessment and peer review components of the Balanced Scorecard Performance 

Measurement and Management Program (BSC P:MMP) to monitor compliance post-award. IPN 

12-03 was published on October 14, 2013, which may be used as the completion date for this 

corrective action. 

Furthermore, as the self-assessment and peer review checklists are subject to regular review and 

updating, OAM will use this process as a mechanism to focus on compliance areas identified 

through internal and external reviews, including audit findings such as recommendation 8 above. 

Finally, on the instant procurement the CO obtained a waiver for the follow-on action under this 

contract, which is in the contract file.

cc: Nanci Gelb, Principal Deputy Assistant Administrator, OARM

Rudolph M. Brevard, Director, Information Resource Management Audits

John Bashista, Director, Office of Acquisition Management, OARM

Todd Hanson, Director, OAM Headquarters Procurement Operation Division, OARM

Brandon McDowell, OARM

Lisa M. Maass, OARM/OAM

OIG Comment: OARM agreed to the recommendation and indicated in its response to the 

draft report that it has taken actions to address this recommendation. However, due to the 

time constraints of the audit, we did not verify that the actions effectively corrected the 

deficiency.
14-P-0332 37

Appendix C

Distribution

Office of the Administrator 

Assistant Administrator for Environmental Information and Chief Information Officer 

Assistant Administrator for Administration and Resources Management 

Agency Follow-Up Official (the CFO) 

Agency Follow-Up Coordinator 

General Counsel 

Associate Administrator for Congressional and Intergovernmental Relations 

Associate Administrator for External Affairs and Environmental Education 

Principal Deputy Assistant Administrator for Environmental Information 

Principal Deputy Assistant Administrator for Administration and Resources Management

Director, Office of Technology Operations and Planning, Office of Environmental Information

Director, Office of Acquisition Management, Office of Administration and 

Resources Management

Director, Office of Policy and Resource Management, Office of Administration and 

Resources Management

Deputy Director, Office of Policy and Resource Management, Office of Administration and 

Resources Management

Audit Follow-Up Coordinator, Office of Environmental Information 

Audit Follow-Up Coordinator, Office of Administration and Resources Management

Audit Follow-Up Coordinator, Office of Acquisition Management, Office of Administration and

Resources Management